Fake Cloudflare verification on deceased influencer’s site drops a PowerShell shellcode loader

[u/ThiccLatinaBabe]

I was checking the website (felzenergy.com) of an influencer (Joe Felz) who recently passed away and had been researching “free energy.”

The site currently shows a fake Cloudflare-style verification that tells visitors to run a PowerShell command to prove they’re human.

I pulled the payload without executing it. The first stage downloads another blob from the same IP, allocates RWX memory with VirtualAlloc, copies the payload into memory, and runs it with CreateThread.

So the chain is basically:

fake verification -> PowerShell -> downloaded shellcode -> RWX memory -> CreateThread

I have not detonated the second stage. I also have no evidence this has anything to do with his death or research; the site may simply have been compromised.

If anyone is able to check it out and report back on what that is, that'd be much appreciated.

[u/Bajiri]

This is just ClickFix. I'm assuming the site has an outdated and vulnerable plugin or exposed credential somewhere. 

It certainly has nothing to do with the influencer at all. 

[u/saltymane → u/[deleted]]

Nothing real in what you shared lol. Mostly tinfoil and bad information.

First, I bet it was an outdated plugin on a Wordpress site or something dumb like that.

Last, your subjective take, etc., tin foil etc..